fbc7b322cd3b6634db94718ed9f06d3bc5873d9b853736da2e399cee9627f1d3

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e039e0d9b16990ad74631b248f53710N.exe
Size

74KB
MD5

4e039e0d9b16990ad74631b248f53710
SHA1

c6f580915f0c24f2fb5584453c310efec0030d1b
SHA256

fbc7b322cd3b6634db94718ed9f06d3bc5873d9b853736da2e399cee9627f1d3
SHA512

14cef4bdbad65a25e9f66220e6bdc71ca78edb5819b454e2f7d2cf33dab74c80f3bd6c129cbad2649c429db94b1ecc2a24a4a5c93c0c476d2d23b50e493e11d0
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YNNdNpyI8yIR5:6e7WpMaxeb0CYJ97lEYNR7kzlSv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\AddUnlock.ocx.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	4e039e0d9b16990ad74631b248f53710N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	4e039e0d9b16990ad74631b248f53710N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e039e0d9b16990ad74631b248f53710N.exe

C:\Users\Admin\AppData\Local\Temp\4e039e0d9b16990ad74631b248f53710N.exe
"C:\Users\Admin\AppData\Local\Temp\4e039e0d9b16990ad74631b248f53710N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
75KB

MD5
19333cd17a31dce16adc934135e6bc64

SHA1
0a501663c53c2a57a0b07aa0f45aa1b9b25b30fb

SHA256
f4dc8c20207bca744e772878279885afe6dba19bf979413edf30ebbfd8d2b599

SHA512
c206e6146e7fcffbc423be0d0c1612766bf836338096a5d212fb900dfe37f21d832e9da68b7813266cc9a1565bf33edc6b130e39ae6c5e1786ed2d638b25913b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
187KB

MD5
cd821d6fdb3f306b4a11bb8d17194124

SHA1
00d5306b45f9117167175b1a80bbc1658adc3d11

SHA256
75d5ffc66e61d0649e492ebe4707faa3108577b5a783deda747d02ee32cd2fce

SHA512
6b7166e8ebd0ad8666c0c61ec7085889c69cd25f166fb0dcb42672e642ec776f45cb8ad525dd255d54440f89cf0514e6a0400cd81ec950cbf64680c27a0cfc25

Download Submit